# Safety and Privacy Boundary

## Required behavior

PIXIE is local-first, preview-first, reversible, legible, and consent-controlled.

The person must be able to see:

- what PIXIE observed;
- what PIXIE inferred;
- what it proposes to do;
- which files and applications are affected;
- what will be shared and with whom;
- how to undo, pause, reset, export, or delete its learned rules.

## Prohibited behavior

PIXIE must not:

- capture raw keystrokes or unrelated screen content;
- inspect private messages or health records to improve file suggestions;
- infer diagnosis, emotion, capacity, compliance, or clinical risk from task behavior;
- share behavioral records with a therapist, caregiver, employer, insurer, collaborator, or platform by default;
- silently rename, move, upload, publish, archive, or delete files;
- punish inactivity through streaks, warnings, guilt, urgency, or reduced functionality;
- treat disagreement with a recommendation as user failure;
- train a shared model on identifiable participant data without separate, informed agreement.

## Learning model

PIXIE learns from explicit acceptance, rejection, correction, and user-authored rules. Passive signals may be used only to offer help in the current task and must remain inspectable.

Example:

> “You reopened this step several times. Would you like fewer choices, a different explanation, help locating the earlier file, or to stop for now?”

PIXIE does not assign an emotional label to the event.

## Health-record access

Health-record access is an optional, private capability—not a condition of using PIXIE. Before showing or using connected records, PIXIE must:

- identify the source and its last known synchronization time;
- warn when a connection is expired or freshness is uncertain;
- distinguish provider-record status from user-confirmed present use;
- let the person choose categories and duration before access;
- avoid copying record content into public repositories, analytics, case studies, or community profiles;
- provide a private access history; and
- allow access to be paused or revoked without disabling non-health features.

A record may inform a user-requested private summary. It may not be repurposed to personalize creative-file suggestions, infer capacity, score consistency, or determine eligibility for participation.

## External sharing

Sharing is a separate action from collection. Each destination and data category requires its own consent. Access should expire, be revocable, and preserve an access log.

Clinical sharing is not part of the initial product. Any later clinical module must be designed with patients, licensed clinicians, privacy and security specialists, and applicable regulatory counsel.

## Children and dependent adults

Do not use PIXIE to covertly monitor another person's behavior. Research or care settings involving children or dependent adults require specialized consent, assent, safeguarding, and data-governance review beyond this repository.